Oracle Listener 设置密码 示例 说明

一.官网说明

MOS 上的一篇文章：

Setting Listener Passwords With an Oracle10g or Newer Listener [ID 260986.1]

这里面提到如下内容：

In Oracle 10gand newer versions of the listener, the listener is secure out of the box.There should be no need to set a listener password to prohibit privilegedLSNRCTL commands from being executed.

--自Oracle10g后，listener 不需要设置密码。

Beginning withversion 10g, thelistener now uses local OS authentication. As long as oneruns LSNRCTL privileged commands (stop, status, etc) as the same user whostarted the listener, that user will be able to fully administer the runninglistener without providing a password.

--从10g开始，listener 使用local OS authentication。

This securityfeature is enabled by default and can be identified at listener startup,or when issuing a LSNRCTL STATUS command, by the following output:

Security ON:Local OS Authentication

If theTNSListener is started as the "oracle" user and the user"sales" attempts to administer the listener, or if"oracle" on a different node attempts to administer thelistener, the following error will be returned:
TNS-01190: The user is not authorized to execute the requested listener command

如果使用oracle用户来启动listener，那么可以使用OS 认证，就不需要输入密码，如果使用其他的用户来登陆，就需要密码了。

1.1 配置密码

Configuring and Changing the Oracle NetListener Password

http://docs.oracle.com/cd/E11882_01/network.112/e10836/listenercfg.htm#NETAG459

Localadministration of the listener is secure by default through the local operatingsystem. Therefore configuring a password is neither required nor recommendedfor secure local administration. However, a password can be configured for thelistener to provide security for administrative operations, such as starting orstopping the listener, viewing a list of supported services, or saving changesto the Listener Control configuration.

--listener 的安全默认使用本地操作系统的认证。 因此对listener 不需要也不推荐。 但是，设置密码可以用来控制管理操作，比如start 或者stop listener，查看supported services 列表或者保存listener的配置。

Note:

If thePASSWORDS_listener_nameparameteris set to an unencrypted password, then you must manually remove it fromthelistener.orafile before changing it. If the unencrypted password isnot removed, then you are unable to set an encrypted password.

--注意，如果PASSWORDS_listener_name 参数被设置为unencryptedpassword，那么必须从listener.ora 文件里移除这个参数，如果该参数没有移除，就不能设置密码。

You can use theListener Control utility (lsnrctl)or Oracle Enterprise Manager toconfigure or change the Oracle Net Listener password.

可以使用lsnrctl 或者OEM，或Oracle Net Listener 来设置密码：

（1）To set a new encrypted passwordusinglsnrctl, do the following:

LSNRCTL> SET PASSWORD

Password: password

The command completed successfully

--该命令用来登陆listener，登陆成功之后才可以进行相关的操作。

（2）To change an encrypted passwordusinglsnrctl, do the following:

LSNRCTL> CHANGE_PASSWORD

Old password: old_password

New password: new_secure_password

Reenter new password: new_secure_password

Connecting to(DESCRIPTION=(ADDRESS=(PROTOCOL=tpc)(HOST=sales-server)(PORT=1521)))

Password changed for LISTENER

The command completed successfully

LSNRCTL> SAVE_CONFIG

Connecting to(DESCRIPTION=(ADDRESS=(PROTOCOL=TCP)(HOST=sales-server)(PORT=1521)))

Saved LISTENER configuration parameters.

Listener Parameter File /oracle/network/admin/listener.ora

Old Parameter File /oracle/network/admin/listener.bak

The command completed successfully

（3）To set or change an encrypted password with OracleEnterprise Manager, do the following:

1）Access theNet Services Administration page in Oracle Enterprise Manager.

2）SelectListenersfromthe Administer list, and then select the Oracle home that contains the locationof the configuration files.

3）ClickGo.You may be prompted to log in to the database server.

The Listeners page appears.

4）Select alistener, and then clickEdit.

The Edit Listeners page appears.

5）ClicktheAuthenticationtab.

6）ClickRequirea password for listener operations.

7）ClickOK.

8）Restart thelistener.

1.2 移除密码

Removing the Listener Password

http://docs.oracle.com/cd/E11882_01/network.112/e10835/mignet.htm#NETRF1971

In OracleDatabase 11gRelease 2 (11.2), the password feature is being deprecated.This does not cause a loss of security because authentication is enforcedthrough local operating system authentication. To migrate a listener that has aset password, do the following:

--在Oracle 11gR2里，listener 的密码功能已经被废除，因为本地的OS 认证被加强。 移除listener 的密码通过如下步骤：

（1）Remove allPASSWORDS_listener_nameentries from thelistener.orafile.

（2）Reload the listener using thefollowing command:

lsnrctl reload listener_name

If remote administration of a listener is required, then use one of the following methodsto connect to and administer the listener.

（1）Connect tothe host where listener is running using SSH or other secure method, and thenperform local administration. Local administration is enforced by the operatingsystem authentication.

（2）Use OracleEnterprise Manager to administer the listener. Oracle Enterprise Manager usesHTTPS, which ensures security.

二.示例

2.1 查看监听状态

LSNRCTL> status

Connecting to(DESCRIPTION=(ADDRESS=(PROTOCOL=IPC)(KEY=EXTPROC1521)))

STATUS of the LISTENER

------------------------

Alias LISTENER

Version TNSLSNR for 32-bit Windows:Version 11.2.0.1.0 - Production

Start Date 18-DEC-2011 10:53:55

Uptime 0 days 9 hr. 38 min. 4 sec

Trace Level off

Security ON: Local OS Authentication

--注意这里默认的安全级别

SNMP OFF

Listener Parameter FileD:\app\Administrator\product\11.2.0\dbhome_1\network\admin\listener.ora

Listener Log Filed:\app\administrator\diag\tnslsnr\DAVIDDAI\listener\alert\log.xml

Listening Endpoints Summary...

(DESCRIPTION=(ADDRESS=(PROTOCOL=ipc)(PIPENAME=\\.\pipe\EXTPROC1521ipc)))

(DESCRIPTION=(ADDRESS=(PROTOCOL=tcp)(HOST=DAVIDDAI)(PORT=1521)))

Services Summary...

Service "CLRExtProc" has 1instance(s).

Instance "CLRExtProc", status UNKNOWN, has 1 handler(s) forthis service...

Service "dave" has 1 instance(s).

Instance "NEWCCS", status UNKNOWN, has 1 handler(s) for thisservice...

Service "newccs" has 1instance(s).

Instance "newccs", status READY, has 1 handler(s) for thisservice...

Service "newccsXDB" has 1instance(s).

Instance "newccs", status READY, has 1 handler(s) for thisservice...

The command completed successfully

2.2 改变密码：

LSNRCTL> change_password

Old password:

New password:

Reenter new password:

Connecting to(DESCRIPTION=(ADDRESS=(PROTOCOL=IPC)(KEY=EXTPROC1521)))

Password changed for LISTENER

The command completed successfully

--查看status

LSNRCTL> status

Connecting to(DESCRIPTION=(ADDRESS=(PROTOCOL=IPC)(KEY=EXTPROC1521)))

STATUS of the LISTENER

------------------------

Alias LISTENER

Version TNSLSNR for 32-bit Windows:Version 11.2.0.1.0 - Production

Start Date 18-DEC-2011 10:53:55

Uptime 0 days 9 hr. 56 min. 54 sec

Trace Level off

Security ON: Password or Local OSAuthentication

--这里的验证方式发生改变，这里显示的额信息表明Listener的安全机制使用了Password方式或者Local OS Authentication方式，在这种状态下，即使是设置了监听密码，对于启动监听的user来说，也仍然是不需要任何密码就可以停止监听的。

SNMP OFF

Listener Parameter FileD:\app\Administrator\product\11.2.0\dbhome_1\network\admin\listener.ora

Listener Log Filed:\app\administrator\diag\tnslsnr\DAVIDDAI\listener\alert\log.xml

Listening Endpoints Summary...

(DESCRIPTION=(ADDRESS=(PROTOCOL=ipc)(PIPENAME=\\.\pipe\EXTPROC1521ipc)))

(DESCRIPTION=(ADDRESS=(PROTOCOL=tcp)(HOST=DAVIDDAI)(PORT=1521)))

Services Summary...

Service "CLRExtProc" has 1instance(s).

Instance "CLRExtProc", status UNKNOWN, has 1 handler(s) forthis service...

Service "dave" has 1 instance(s).

Instance "NEWCCS", status UNKNOWN, has 1 handler(s) for thisservice...

Service "newccs" has 1instance(s).

Instance "newccs", status READY, has 1 handler(s) for thisservice...

Service "newccsXDB" has 1instance(s).

Instance "newccs", status READY, has 1 handler(s) for thisservice...

The command completed successfully

--保存配置：

LSNRCTL> save_config

Connecting to(DESCRIPTION=(ADDRESS=(PROTOCOL=IPC)(KEY=EXTPROC1521)))

Saved LISTENER configuration parameters.

Listener Parameter FileD:\app\Administrator\product\11.2.0\dbhome_1\network\admin\listener.ora

Old Parameter FileD:\app\Administrator\product\11.2.0\dbhome_1\network\admin\listener.bak

The command completed successfully

--注意这里，当我们改变密码之后，在保存配置时，原listener.ora 文件保存了listener.bak. 修改的参数添加到现在的listener.ora 文件里。

查看listener.ora 文件，多了一个密码：

#----ADDED BY TNSLSNR 18-DEC-201120:52:38---

PASSWORDS_LISTENER = 1DF5C2FD0FE9CFA2

#--------------------------------------------

2.3 用Listener密码登陆

默认口令为空.

LSNRCTL> set password

Password:

The command completed successfully

2.4 测试一: 用启动listener的用户

C:\Users\Administrator.DavidDai>lsnrctl

LSNRCTL for 32-bit Windows: Version 11.2.0.1.0- Production on 18-DEC-2011 21:13:42

Copyright (c) 1991, 2010, Oracle. All rights reserved.

Welcome to LSNRCTL, type "help"for information.

LSNRCTL> set current_listener listener

Current Listener is listener

LSNRCTL> stop

Connecting to (DESCRIPTION=(ADDRESS=(PROTOCOL=IPC)(KEY=EXTPROC1521)))

The command completed successfully

LSNRCTL> start

Starting tnslsnr: please wait...

TNSLSNR for 32-bit Windows: Version11.2.0.1.0 - Production

System parameter file isD:\app\Administrator\product\11.2.0\dbhome_1\network\admin\listener.ora

Log messages written tod:\app\administrator\diag\tnslsnr\DAVIDDAI\listener\alert\log.xml

Listening on:(DESCRIPTION=(ADDRESS=(PROTOCOL=ipc)(PIPENAME=\\.\pipe\EXTPROC1521ipc)))

Listening on:(DESCRIPTION=(ADDRESS=(PROTOCOL=tcp)(HOST=DAVIDDAI)(PORT=1521)))

Connecting to(DESCRIPTION=(ADDRESS=(PROTOCOL=IPC)(KEY=EXTPROC1521)))

STATUS of the LISTENER

------------------------

Alias listener

Version TNSLSNR for 32-bit Windows:Version 11.2.0.1.0 - Production

Start Date 18-DEC-2011 21:15:59

Uptime 0 days 0 hr. 0 min. 5 sec

Trace Level off

Security ON: Password or Local OSAuthentication

SNMP OFF

Listener Parameter FileD:\app\Administrator\product\11.2.0\dbhome_1\network\admin\listener.ora

Listener Log Filed:\app\administrator\diag\tnslsnr\DAVIDDAI\listener\alert\log.xml

Listening Endpoints Summary...

(DESCRIPTION=(ADDRESS=(PROTOCOL=ipc)(PIPENAME=\\.\pipe\EXTPROC1521ipc)))

(DESCRIPTION=(ADDRESS=(PROTOCOL=tcp)(HOST=DAVIDDAI)(PORT=1521)))

Services Summary...

Service "CLRExtProc" has 1instance(s).

Instance "CLRExtProc", status UNKNOWN, has 1 handler(s) forthis service...

Service "dave" has 1 instance(s).

Instance "NEWCCS", status UNKNOWN, has 1 handler(s) for thisservice...

The command completed successfully

LSNRCTL>

通过以上测试，对于启动listener的用户，不需要密码。

2.5. 设置 LOCAL_OS_AUTHENTICATION 参数

OS 认证是Oracle 10g里推出的，所以我这里直接禁用掉OS认证，这样只要密码文件存在，所有操作都需要set password。

在listener.ora 文件里添加如下参数：

LOCAL_OS_AUTHENTICATION_[listenername]=OFF

--开始测试：

C:\Users\Administrator.DavidDai>lsnrctlreload listener

LSNRCTL for 32-bit Windows: Version11.2.0.1.0 - Production on 18-DEC-2011 21:41:10

Copyright (c) 1991, 2010, Oracle. All rights reserved.

Connecting to(DESCRIPTION=(ADDRESS=(PROTOCOL=IPC)(KEY=EXTPROC1521)))

The command completed successfully

C:\Users\Administrator.DavidDai>lsnrctlstatus

LSNRCTL for 32-bit Windows: Version11.2.0.1.0 - Production on 18-DEC-2011 21:41:21

Copyright (c) 1991, 2010, Oracle. All rights reserved.

Connecting to(DESCRIPTION=(ADDRESS=(PROTOCOL=IPC)(KEY=EXTPROC1521)))

TNS-01169: The listenerhas not recognized the password

这里就需要我们输入密码了。

C:\Users\Administrator.DavidDai>lsnrctl

LSNRCTL for 32-bit Windows: Version11.2.0.1.0 - Production on 18-DEC-2011 21:41:55

Copyright (c) 1991, 2010, Oracle. All rights reserved.

Welcome to LSNRCTL, type "help"for information.

LSNRCTL> set current_listener listener

Current Listener is listener

LSNRCTL> status

Connecting to(DESCRIPTION=(ADDRESS=(PROTOCOL=IPC)(KEY=EXTPROC1521)))

TNS-01169: The listener has not recognizedthe password

LSNRCTL> set password

--设置密码后，操作成功

Password:

The command completed successfully

LSNRCTL> status

Connecting to(DESCRIPTION=(ADDRESS=(PROTOCOL=IPC)(KEY=EXTPROC1521)))

STATUS of the LISTENER

------------------------

Alias listener

Version TNSLSNR for 32-bit Windows: Version11.2.0.1.0 - Production

Start Date 18-DEC-2011 21:15:59

Uptime 0 days 0 hr. 26 min. 22 sec

Trace Level off

Security ON: Password

SNMP OFF

Listener Parameter FileD:\app\Administrator\product\11.2.0\dbhome_1\network\admin\listener.ora

Listener Log Filed:\app\administrator\diag\tnslsnr\DAVIDDAI\listener\alert\log.xml

Listening Endpoints Summary...

(DESCRIPTION=(ADDRESS=(PROTOCOL=ipc)(PIPENAME=\\.\pipe\EXTPROC1521ipc)))

(DESCRIPTION=(ADDRESS=(PROTOCOL=tcp)(HOST=DAVIDDAI)(PORT=1521)))

Services Summary...

Service "CLRExtProc" has 1instance(s).

Instance "CLRExtProc", status UNKNOWN, has 1 handler(s) forthis service...

Service "dave" has 1 instance(s).

Instance "NEWCCS", status UNKNOWN, has 1 handler(s) for thisservice...

Service "newccs" has 1instance(s).

Instance "newccs", status READY, has 1 handler(s) for thisservice...

Service "newccsXDB" has 1instance(s).

Instance"newccs", status READY, has 1 handler(s) for this service...

The command completed successfully

LSNRCTL>

2.7 移除密码

如果监听已启动，密码忘记了，直接修改listener.ora文件是没用的，因为那个文件在监听启动后甚至可以删除，所以可以先在操作系统中kill掉系统进程，然后在listener.ora文件中移除PASSWORDS_LISTENER参数，再启动监听密码恢复为空。

小结：

在Oracle 10g 以后已经不推荐对listener 设置密码了，所以这里仅做为一个知识点了解一下。

-------------------------------------------------------------------------------------------------------

版权所有，文章允许转载，但必须以链接方式注明源地址，否则追究法律责任!

Email: [email protected]

Skype: tianlesoftware

Blog: http://www.tianlesoftware.com

Weibo: http://weibo.com/tianlesoftware

Twitter: http://twitter.com/tianlesoftware

Facebook:http://www.facebook.com/tianlesoftware

-------加群需要在备注说明Oracle表空间和数据文件的关系，否则拒绝申请----

DBA1 群：62697716(满); DBA2 群：62697977(满)DBA3 群：62697850(满)

DBA 超级群：63306533(满); DBA4 群：83829929 DBA5群： 142216823

DBA6 群：158654907 DBA7 群：172855474